AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution

What it is

AutoJack is a research exploit chain in AutoGen Studio (Microsoft Research's AutoGen multi-agent prototyping UI). The vulnerable MCP WebSocket handler shipped only in PyPI pre-releases 0.4.3.dev1 and 0.4.3.dev2 — the stable 0.4.2.2 has no MCP route at all. Both dev builds remain on PyPI, unyanked, and no released build carries the fix; the patch exists only in GitHub main at commit b047730 (PR #7362).

What to do

The summary establishes the chain and the packaging boundary but gives no remediation. The page's concrete guidance:

• Plain pip install autogenstudio gives 0.4.2.2 (no MCP route) — not affected. pip won't pull the dev builds unless you pass --pre or pin the version.
• If you installed a pre-release, there is no patched PyPI build to upgrade to. Pull from GitHub main at or after commit b047730 — the article calls this "the real fix."
• Until a release ships, break the shared-localhost precondition: do not run AutoGen Studio on the same machine as a browsing or code-execution agent that touches untrusted content. If they must co-locate, isolate in separate containers/VMs and run AutoGen Studio under a low-privilege account.

The fix mechanism

The hardened handler no longer reads the command from the URL. Request parameters are stored server-side behind a one-time session ID, and unknown IDs are refused. MCP routes now pass through the normal authentication middleware rather than being skipped.

flowchart TD
    A[Agent loads attacker page] --> B{localhost check}
    B -->|agent IS localhost| C{auth middleware}
    C -->|MCP paths skipped, handler never verifies| D[command from request param]
    D -->|no allowlist| E[RCE under AutoGen Studio account]
    C -.->|b047730: MCP routes now authenticated| X[blocked]
    D -.->|b047730: one-time session ID, cmd not in URL| X

Also

The page names the Semantic Kernel RCE the summary references only generically: CVE-2026-26030 and CVE-2026-25592. Microsoft reports no exploitation in the wild; the PoC merely pops calc.exe.